Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 24 Sep 2002 22:31:34 +0200

> > => Do networks deploying MIPv4 run ingress filtering
  > > if there was no reverse tunnelling from the FA?
  > >
  > 
  > Whether they do or not, reverse tunneling came about
  > because of ingress filtering, at least according to RFC 2344
  > that specifies reverse tunneling.
  > So, there is precedence in the standards process.

=> But you're just confirming the need for following
ingress filtering recommendations, right?
In MIPv6 we don't want to reverse tunnel if RO is used.

  > >   > This is hard work with questionable incentives, especially if
  > >   > the tunnel lifetime is kept short.
  > >
  > > => As I said earlier, in a real situation there is probably
  > > more than one MN doing a handover, so there is more
  > > than one of those addresses.
  > >
  > 
  > But to use more than one address, you need to keep spoofing
  > all those addresses and use them when their respective windows
  > are open. So, I still think the incentives are questionable.

=> An attacker doing DoS attacks doesn't need to worry
about any windows. He just snoops the link and pick
addresses and send away, if they go through the AR
then great, if they don't it doesn't matter.

  > However, we should include these issues under Security 
  > Considerations.

=> I guess it's up to the WG to decide how important this is.
Perhaps this can be discussed in the new 802.11 work.

Hesham

---

From: Rajeev Koodli <[email-masked]>
Date: Tue, 24 Sep 2002 13:55:39 -0700

> In MIPv6 we don't want to reverse tunnel if RO is used.

I am confirming that there is a standards precedence for
supporting topologically inconsistent addresses, using reverse
tunneling. Ironically, in order to support RO in MIPv6, you
would have to allow use of previous CoA (until RR is done)
and reverse tunnel to previous AR.

> then great, if they don't it doesn't matter.

So, if the window is not open, there is no damage to an
external network. And, may be you can trace the attacker
in that case :-)

> Perhaps this can be discussed in the new 802.11 work.

Ok.

-Rajeev

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Tue, 24 Sep 2002 17:16:21 -0700

In the absence of sufficient link security where
anyone can spoof anyone else's source mac and IP
address, I don't think use of oldCoA at the new-link
presents an additional security risk. Ingress filtering is
about preventing untraceable attacks, and in this case
one can trace the attack back to oldAR, and to newAR
due to the state associated with this IP address. If this
tracing cannot be done in real-time (note that the associated
state has a lifetime), one has to rely on oldAR keeping
a log of such state..

alper

----- Original Message -----
From: "Rajeev Koodli" <[email-masked]>
To: "Hesham Soliman (EAB)" <[email-masked]>
Cc: "'James Kempf'" <[email-masked]>;
<[email-masked]>
Sent: Tuesday, September 24, 2002 1:55 PM
Subject: Re: [mobile-ip] fastv6 and CoAs

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 21:12:41 -0700

> then great, if they don't it doesn't matter.

Right, but this doesn't have anything to do with ingress filtering. The attacker
is using legitimate addresses, not addresses with an improper prefix. My
understanding of ingress filtering (which may not match yours) is that it is
designed to prevent an attack that uses a prefix different from the one being
routed on the link. Like a MN sending a packet with its home address from the
foreign link. That's why reverse tunneling was put into MIPv4, as Rajeev
mentioned.

It is because there is currently no way to tie down a particular IP address to a
particular MAC address (presuming the MAC address can't be spoofed). This
doesn't have anything to do with fast handover, it is a general property of
multiaccess links. If the link is wired and running 802.1x through a switch,
then the switch can tie down the MAC address to a particular port. An attacker
that tried to send his MAC address or to spoof someone elses from a different
port would be caught.

            jak